{"id":"CVE-2019-14234","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-14234","generatedAt":"2026-10-29T00:09:38.378Z","title":"Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection.","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","published":"2019-08-09T13:15:12.000Z","lastModified":"2026-06-17T02:18:00.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-89"],"affected":["djangoproject/django","fedoraproject/fedora","debian/debian linux"],"epss":{"score":0.47694,"percentile":0.98842,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.38854,"percentile":0.98565},{"date":"2026-09-22","score":0.47694,"percentile":0.98793}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 47.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-22T00:00:00.000Z","detail":{"to":0.47694,"from":0.38854,"percentile":0.98793},"summary":"EPSS moved from 38.9% to 47.7% probability of exploitation in the next thirty days."}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs","source":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/","source":"cve@mitre.org"},{"url":"https://seclists.org/bugtraq/2019/Aug/15","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202004-17","source":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190828-0002/","source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2019/dsa-4498","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.djangoproject.com/weblog/2019/aug/01/security-releases/","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Aug/15","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202004-17","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190828-0002/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4498","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.djangoproject.com/weblog/2019/aug/01/security-releases/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-14234","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}